Supernotes and Poorly Cloned Darknet Sites

I was on safari in the darknet this morning and I came across the site above. The address is druglixdfcb3gda3.onion and as you can see it proclaims it is selling supernotes of American currency. Of course this is always of interest to me and they are making claims about printing specs and things that sound right. However, when you look closer at the site you see that it is not quite finished. It has some lorem ipsum text in there and it also has a lot of broken image links so you get no sample images at all even though they are linking to them.

They even have testimonials! Yet they don’t work either. Now, it got my interest at the bottom there where the site is claiming that you can contact them on the information below. Which, well, is all clearnet addressing and contains a physical address in Italy as well as a domain and email address in the UK! I had to look twice there to make sure I wasn’s seeing things. So I began looking more closely at the code and pulled up the information on the domain that they listed with a contact email of contact@andia.co.uk.

Once I pulled up Domain Tools, I saw that the domain has been around since 2014 and has not changed hands. I did some looking on the Wayback Machine and saw that there really never has been a site and that the names attached to the firm were a couple guys in London, which matched the address in the domain data. I then looked up these guys and found some interesting congruences. Andia LTD has been dissolved as of 2016 and dig this, one of these guys is a specialist in “bank fraud”

*blink blink*

So, um, how coincidental is it that this domain of a dissolved company of a couple thirty somethings in the UK has one that is a specialist in banking and fraud? Hmmmmm… Well, it goes down the rabbit hole pretty quickly and I was thinking OK! I am on to something here but then I started to look at the code some more… It turns out that if you start to Google the code and key words on the page you get a LOT of hits elsewhere. It turns out that this site in the darknet was using code from a free template created by this guy Anli Zaimi, who has a bunch of these templates. So, was this all just for naught? I mean, there are a lot of sites that seem really really sketch using his template and many do not bother to redact the contact details that he put in there.

Also, since this domain is real (andia.co.uk) how does that fit in? Then there is the whole thing with the banking connection and failed businesses. I am letff scratching my head a little here. I mean, who puts up a forgers site so poorly in the darknet? OK ok ok, the darknet really is the Geoshitties of the 2000’s right? So yeah some nitwit just flung this hapless piece of shit up there…

But…

This site has been around a while. Why? No changes? Static and just bad.

Oh well… I even did the due diligence and emailed the contact address and it bounced, so, it ain’t there. I guess in the end it just shows you that the darknet is a garbage heap full of the strangest detritus. I did learn one thing though, this guy’s template is the go to for scammers it seems.

It’s just that most of them are so code illiterate that they don’t take out the dummy data and leave a long trail on google.